[GH-ISSUE #270] SHA-256 mismatch for v2.0.0.tar.gz #803

New issue

Closed

opened 2026-03-15 10:32:09 +03:00 by kerem · 5 comments

kerem commented

2026-03-15 10:32:09 +03:00

Owner

Originally created by @ilovezfs on GitHub (Mar 1, 2018).
Original GitHub issue: https://github.com/asciinema/asciinema/issues/270

Homebrew users currently cannot build asciinema from source due to a SHA-256 checksum mismatch for v2.0.0.tar.gz (https://github.com/asciinema/asciinema/archive/v2.0.0.tar.gz)

Sun Feb 11 00:05:37 2018 -0800 the SHA-256 was
65224d8dcc8c579fd678fff83ea89eecfd35a1d2ca853ee6fcf27d2f7b5e3205

Now it's changed to
ef7c6143dfe1d3ae77fd5d41ef93344e0c5f840b1272a11f41938e1b718baf0f

Do you have any idea what happened here? To rule out malicious circumstances, we'll need to know why the file has changed before the checksum can be updated in Homebrew. Thanks!

Originally created by @ilovezfs on GitHub (Mar 1, 2018). Original GitHub issue: https://github.com/asciinema/asciinema/issues/270 Homebrew users currently cannot build asciinema from source due to a SHA-256 checksum mismatch for v2.0.0.tar.gz (https://github.com/asciinema/asciinema/archive/v2.0.0.tar.gz) Sun Feb 11 00:05:37 2018 -0800 the SHA-256 was 65224d8dcc8c579fd678fff83ea89eecfd35a1d2ca853ee6fcf27d2f7b5e3205 Now it's changed to ef7c6143dfe1d3ae77fd5d41ef93344e0c5f840b1272a11f41938e1b718baf0f Do you have any idea what happened here? To rule out malicious circumstances, we'll need to know why the file has changed before the checksum can be updated in Homebrew. Thanks!

kerem closed this issue

2026-03-15 10:32:15 +03:00

kerem commented

2026-03-15 10:32:20 +03:00

Author

Owner

@ilovezfs commented on GitHub (Mar 1, 2018):

Ref https://jenkins.brew.sh/job/Homebrew%20Core%20Pull%20Requests/19419/version=high_sierra/testReport/junit/brew-test-bot/high_sierra/fetch_asciinema/

@ilovezfs commented on GitHub (Mar 1, 2018): Ref https://jenkins.brew.sh/job/Homebrew%20Core%20Pull%20Requests/19419/version=high_sierra/testReport/junit/brew-test-bot/high_sierra/fetch_asciinema/

kerem commented

2026-03-15 10:32:25 +03:00

Author

Owner

@ku1ik commented on GitHub (Mar 1, 2018):

I have updated the v2.0.0 tag. Specifically I've removed it and then created a new signed one.
Given that signed tags are more like commits this could have changed the checksum of the tarball...

@ku1ik commented on GitHub (Mar 1, 2018): I have updated the `v2.0.0` tag. Specifically I've removed it and then created a new signed one. Given that signed tags are more like commits this could have changed the checksum of the tarball...

kerem commented

2026-03-15 10:32:31 +03:00

Author

Owner

@ku1ik commented on GitHub (Mar 11, 2018):

@ilovezfs has the checksum been updated in Homebrew? Can we close this?

@ku1ik commented on GitHub (Mar 11, 2018): @ilovezfs has the checksum been updated in Homebrew? Can we close this?

kerem commented

2026-03-15 10:32:36 +03:00

Author

Owner

@ilovezfs commented on GitHub (Mar 11, 2018):